Virtual Open Systems Scientific Publications

Introduction

The Fifth Generation (5G) mobile networks are promising greater data capacity and speed as well as enabling new applications and services. Cloud computing and virtualization have become an integral part of these networks that are today becoming more dynamic and agile thanks to cloud-native and edge computing technologies. In particular, edge computing brings the benefits of reduced network traffic, location-awareness and low-latency while cloud-native solutions improve performance and reduce cloud services footprint. However, both open new security challenges. In fact, the edge computing scattered architecture and the wireless connectivity increase the risk of man-in-the-middle attacks, with a major threat of device tampering or replacement. Moreover, cloud-native solutions aim to simplify all levels of the 5G software stack, optimizing it for cloud execution and removing unnecessary dependencies with bare metal solutions. Nevertheless, they significantly rely on the virtualization infrastructure for security. Among the many known aspects of the cloud-native and edge security, the protection of the virtualization infrastructure and the platform integrity are the focus of this work.

We propose a trusted edge computing infrastructure based on Arm edge devices. In addition, we add attestation extensions to OpenStack, one of the most widely adopted open-source cloud managers. The combination of a remote attestation integrated into the virtualized infrastructure management software and a trusted pool of devices brings a secure and trusted virtualized edge.

As part of this work, we perform a series of measurements showing the trade-off between performance and increased security. The experiments are conducted using standard virtual machines (VMs), showing the worst-case scenario in terms of guest boot times. However, the same concept is still applicable when working with unikernels or containers which can achieve a faster boot.